CVE-2026-13739Commvault Commvault Cloud
NVD
Vulnerability Summary
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
CVSS v4.0 Base Metrics — Score 8.8 (HIGH)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:NAttack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)Low
Availability (Vulnerable System)Low
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Affected & Patched Versions
- Commvault Commvault Cloud >= 11.46.0 and <= 11.46.9
- Commvault Commvault Cloud >= 11.44.0 and <= 11.44.10
- Commvault Commvault Cloud >= 11.40.0 and <= 11.40.62
- Commvault Commvault Cloud >= 11.36.0 and <= 11.36.113
- Commvault Commvault Cloud 11.46.9
- Commvault Commvault Cloud 11.44.10
- Commvault Commvault Cloud 11.40.62
- Commvault Commvault Cloud 11.36.113
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run Commvault Commvault Cloud and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Aug 11, 2026Published
- Aug 11, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Commvault Commvault Cloud CVEsYou are reading CVE-2026-13739. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
Data last checked: Nov 15, 2026 03:31 UTC